Latvia

Situation Summary

Latvia remains a low-threat environment overall (composite ranking #130 globally), but faces acute localized security pressures along its eastern border with Belarus and within its cyber infrastructure. Recent 48-hour activity indicates sustained migration pressure, repeated airspace incursions, and exploitation of a major national data breach affecting 1.2 million individuals. Defense-sector sabotage investigations and organized-crime operations add complexity to the threat landscape, though incidents remain geographically concentrated in the east and south.

Key Developments

• Krāslava municipality, Latvia–Belarus border – 20–21 August: Border guards detained 28 irregular migrants who crossed via a newly discovered underground tunnel from Belarus. The tunnel discovery signals infrastructure-based infiltration capability and localized heightened border-crossing risk in Krāslava novads.

• Latvia–Belarus border, multiple sectors – 20 August: 109 attempted irregular border crossings were thwarted in a single day, indicating sustained migration pressure and elevated enforcement tempo across the entire eastern frontier.

• Balvi region (Ruga/Rugāji area) – early hours of 21 August: NATO fighter jets shot down an unidentified foreign drone that entered Latvian airspace, likely from Belarus and subject to Russian electronic warfare. No casualties or ground damage reported.

• Road Traffic Safety Directorate (CSDD) cyberattack – 7–8 August; active fraud exploitation 21–22 August: The breach of 1.2 million personal and 200,000 entity records remains actively exploited by fraudsters for phishing and social engineering, though the full dataset has not been confirmed as publicly sold. Presidential and ministerial review ongoing.

• Defense-sector sabotage convictions – 21 August: Two individuals convicted in Latvia for conducting sabotage operations on behalf of Russian security services targeting PILOT Automotive Labs Europe; concurrent reporting links suspects to an arson attempt on Estonian defense firm Milrem Robotics.

• Organized-crime investigations – 22 August: Active homicide and organized-crime investigations underway involving contract killing arrangements, indicating sustained violent-crime pressure in criminal networks.

Highest-Risk Areas

Rēzekne (risk 68) and Daugavpils (risk 65) dominate the sub-national ranking, with all top-12 highest-risk regions concentrated in southeastern and eastern Latvia—Rēzeknes novads, Ludzas novads, Balvu novads, and Krāslava novads all scoring 48–58. This geographic concentration reflects proximity to the Belarus border, where migration pressure, smuggling infrastructure (tunnel discovery), airspace incursions, and historical sabotage activity cluster. Border enforcement intensity and cross-border criminal networks drive sustained elevated risk in these districts.

How GeoBit Would Assist

Security teams should deploy Area-of-Interest (AOI) monitoring and early warning on the Krāslava and Balvi border regions to track repeated crossing attempts and airspace incidents in near-real time. Network and actor analysis applied to CSDD breach exploitation and Russian sabotage investigations would help identify coordinated fraud campaigns and state-linked operatives. Multi-language OSINT fusion across social media, Telegram, and local news feeds would provide continuous early warning of migration waves, drone activity, and organized-crime developments before they escalate.

7-Day Outlook

Expect continued elevated migration pressure and border enforcement activity along the Belarus frontier, with elevated risk of further airspace incursions in the Balvi/Ruga sector through late August. Cyber-fraud exploitation of the CSDD breach will likely intensify as stolen data circulates in criminal networks, requiring heightened corporate vigilance on phishing and social engineering. Sabotage investigations will remain active, particularly affecting defense-sector companies.

Highest-Risk Areas — Ranked

Previous Daily Briefs

A new Latvia brief is written every day — each with its own risk map and downloadable CSV. Here's the last week; use the calendar to go further back.

• August 20, 2026⬇ CSV · $5
• August 17, 2026⬇ CSV · $5
• August 15, 2026⬇ CSV · $5
• August 13, 2026⬇ CSV · $5
• August 11, 2026⬇ CSV · $5
• August 9, 2026⬇ CSV · $5
• August 8, 2026⬇ CSV · $5